What’s New in OWASP Top 10 2021? Key Changes, Updated Categories, and Security Recommendations

The Open Web Application Security Project (OWASP) is a foundational benchmark for web application security. Revised periodically to reflect the evolving threat landscape, the OWASP Top 10 2021 marked a major structural and conceptual shift compared to its 2017 predecessor.

Understanding these changes is crucial for software developers, security architects, and IT leaders building resilient applications. This article breaks down what changed in the 2021 update, explores each of the ten vulnerability categories in detail, and offers actionable security recommendations.

Key Structural & Methodology Changes in OWASP 2021

The OWASP Top 10 2021 was not just a reshuffling of existing vulnerabilities; it represented a fundamental pivot in how application risks are evaluated and categorized:

• Design vs. Implementation: Previous iterations focused primarily on implementation flaws (e.g., coding mistakes like SQL Injection). The 2021 update introduced architecture-level security concepts like Insecure Design, signaling that security must be integrated before code is written.
• Data-Driven Analysis with Community Insight: OWASP analyzed over 500,000 applications using dynamic and static testing tools. However, eight categories were selected purely based on statistical data, while two categories (Insecure Design and Software and Data Integrity Failures) were added based on the community industry survey.
• Shift to Root Causes: Several categories were renamed or merged to address broader root causes rather than narrow symptoms (e.g., renaming Sensitive Data Exposure to Cryptographic Failures).

Detailed Breakdown of the OWASP Top 10 2021 Categories

Below is the complete analysis of the ten risk categories featured in the OWASP Top 10 2021:

+-----------------------------------------------------------------------+
|                        OWASP Top 10 2021                              |
+-----------------------------------------------------------------------+
| A01:2021 - Broken Access Control                                      |
| A02:2021 - Cryptographic Failures                                     |
| A03:2021 - Injection                                                  |
| A04:2021 - Insecure Design                                            |
| A05:2021 - Security Misconfiguration                                  |
| A06:2021 - Vulnerable and Outdated Components                         |
| A07:2021 - Identification and Authentication Failures                  |
| A08:2021 - Software and Data Integrity Failures                       |
| A09:2021 - Security Logging and Monitoring Failures                   |
| A10:2021 - Server-Side Request Forgery (SSRF)                         |
+-----------------------------------------------------------------------+

A01:2021 – Broken Access Control

• Movement: Climbed from #5 in 2017 to the #1 spot in 2021.
• Overview: Access control ensures that users act only within their assigned permissions. When broken, unauthorized users can view, modify, or delete sensitive data, escalate privileges, or access restricted administrative portals.
• Key Causes: Insecure Direct Object References (IDOR), missing function-level access control, parameter tampering in URLs or APIs, and misconfigured CORS policies.

A02:2021 – Cryptographic Failures

• Movement: Formerly known as Sensitive Data Exposure (#3 in 2017), renamed and moved up to #2.
• Overview: The name change shifts focus to the underlying cause: flawed or missing encryption. Weak cryptography exposes sensitive information such as passwords, healthcare records, credit card numbers, and PII.
• Key Causes: Transmitting data in clear text (HTTP, FTP), using outdated cryptographic algorithms (MD5, SHA1), hardcoded encryption keys, or failing to enforce proper password hashing algorithms like Argon2 or bcrypt.

A03:2021 – Injection

• Movement: Dropped from #1 in 2017 to #3 in 2021.
• Overview: Injection occurs when untrusted user input is passed into an interpreter as part of a command or query. Cross-Site Scripting (XSS) was formally merged into the Injection category in the 2021 standard.
• Key Causes: Failing to sanitize user inputs, dynamic string concatenation in database queries (SQLi), operating system commands (OS Injection), or LDAP queries.

A04:2021 – Insecure Design

• Movement: NEW Category introduced directly at #4.
• Overview: Unlike implementation flaws, Insecure Design addresses missing or flawed security architectures. Even perfectly written code cannot fix an inherently flawed application design.
• Key Causes: Absence of threat modeling, lack of secure design patterns, missing business logic validation (e.g., allow-listing user roles), or building systems without defining clear trust boundaries.

A05:2021 – Security Misconfiguration

• Movement: Moved up from #6 to #5, absorbing XML External Entities (XXE).
• Overview: Security misconfigurations occur when systems, frameworks, or cloud infrastructures are deployed with insecure defaults or overly permissive settings.
• Key Causes: Unchanged default credentials, verbose error pages exposing stack traces, unpatched cloud storage buckets (S3), and unnecessarily open network ports or web server options.

A06:2021 – Vulnerable and Outdated Components

• Movement: Moved up from #9 to #6.
• Overview: Modern web applications heavily rely on third-party libraries, frameworks, and open-source packages. Running outdated components with known vulnerabilities exposes the system to automated exploitation.
• Key Causes: Unmanaged open-source dependencies, lack of automated software bill of materials (SBOM) tracking, and unpatched runtime environments or web servers.

A07:2021 – Identification and Authentication Failures

• Movement: Formerly Broken Authentication (#2 in 2017), moved down to #7.
• Overview: This category covers flaws in establishing user identity, managing credentials, and maintaining user sessions.
• Key Causes: Susceptibility to credential stuffing or brute-force attacks, permitting weak or default passwords, weak session timeout management, or exposing session identifiers in URLs.

A08:2021 – Software and Data Integrity Failures

• Movement: NEW Category introduced at #8, incorporating Insecure Deserialization from 2017.
• Overview: Focuses on code and infrastructure that do not protect against integrity violations during updates or data ingestion. It explicitly highlights supply chain security risks.
• Key Causes: Auto-updating applications without cryptographic verification, untrusted CI/CD pipelines, pulling unverified packages from public registries, and insecure object deserialization.

A09:2021 – Security Logging and Monitoring Failures

• Movement: Formerly Insufficient Logging & Monitoring (#10 in 2017), moved up to #9.
• Overview: Without proper logging and active monitoring, security breaches go undetected. The average time to detect a breach often spans months, giving attackers ample time to pivot internally.
• Key Causes: Failing to log critical authentication or access control events, logs stored only locally without centralized forwarding, or a lack of real-time alert thresholds for suspicious behavior.

A10:2021 – Server-Side Request Forgery (SSRF)

• Movement: NEW Category added at #10 based on community survey data.
• Overview: SSRF occurs when a web application fetches a remote resource without validating the user-supplied URL. This forces the vulnerable server to act as a proxy to make unauthorized requests to internal systems behind firewalls.
• Key Causes: Fetching external images or webhooks via user input without strict destination domain or IP allow-listing.

Comparison Table: OWASP Top 10 2017 vs. 2021

Core Security Recommendations for Organizations

To mitigate the risks outlined in the OWASP Top 10 2021, engineering and security teams should adopt the following actionable best practices:

1. Shift Security Left with Threat Modeling:Incorporate threat modeling, secure design patterns, and reference architectures into the initial design phase to tackle Insecure Design.
2. Enforce Role-Based Access Control (RBAC) Server-Side:Never trust client-side parameters. Deny access by default, and enforce access control mechanisms on every API endpoint and controller.
3. Automate Dependency Management:Integrate Software Composition Analysis (SCA) tools into CI/CD pipelines to automatically scan third-party dependencies for known vulnerabilities and manage licenses.
4. Encrypt Everything in Transit & at Rest:Enforce TLS 1.3 across all communication channels. Secure sensitive data using standardized algorithms (e.g., AES-256) and store passwords using strong key derivation functions like Argon2.
5. Implement Robust Input Validation & Output Encoding:Use parameterized queries (prepared statements) for all database interactions to eliminate SQL Injection. Sanitize and encode all output to prevent Cross-Site Scripting.
6. Harden Cloud Infrastructure & Configurations:Maintain continuous security posture management (CSPM) to catch misconfigured cloud storage, exposed admin panels, or default credentials.
7. Centralize & Monitor Logs:Ensure all critical events (logins, privilege escalations, access control failures) generate structured logs forwarded to a centralized SIEM system with real-time alerting.

Conclusion

The OWASP Top 10 2021 reinforces a critical message: application security is no longer just about fixing buggy code. With the introduction of categories like Insecure Design and Software and Data Integrity Failures, security must be treated as an ongoing lifecycle discipline spanning architecture, supply chain, and infrastructure. By aligning development workflows with these updated recommendations, organizations can effectively reduce their attack surface and build resilient software.